Use 1Password to broker access to secrets in custom workflows at runtime (public alpha)

If an administrator has connected an OIDC provider to your 1Password Business account, you can use 1Password to broker access to secrets from your 1Password Environments in your custom workflows at runtime.

Step 1: Set up an Environment

To configure the variables you need to use in a custom workflow, make sure you have the latest beta release of the 1Password desktop app, then create a new 1Password Environment with your variables or add your variables to an existing Environment.

Step 2. Connect your Environment to your workflow

After you’ve set up an Environment and added your secrets, you can connect the Environment to your workflow:

Open your Environment, then select Connect in the Generic OIDC section.
If you’ve already connected your Environment to a workflow, select Connect instead, then select Connect in the Generic OIDC section.
Enter a name for your workflow, then choose the integration for the OIDC provider you need to use.
(Optional) Define any additional access conditions you want to enforce. You’ll also see any inherited conditions your administrator configured for the integration.
Select Connect.

Step 3: Use your Environment in your workflow

After you’ve connected your Environment to a custom workflow, you’ll need to create a 1Password SDK client configured with a custom function to fetch your OIDC token. The client authenticates using your OIDC token, workload ID, and the integration key configured by your administrator, then uses a function to retrieve secrets from your Environment using the Environment ID.

Brokered access is only supported in the the 1Password JavaScript SDK at this time.

Usage example

The following example shows how you can use a 1Password JavaScript SDK client to call a function that fetches your OIDC token, then uses it alongside the other required variables to retrieve secrets from your Environment in a GitLab CI/CD job.

1Password SDK client example
GitLab CI/CD job example

op-client-example.js

const sdk = require("@1password/sdk");
const { spawn } = require("node:child_process");

async function fetchOidcToken() {
    return process.env.GITLAB_SUBJECT_TOKEN;
}

function loginToDockerCLI(username, token) {
    return new Promise((resolve, reject) => {
        const login = spawn(
            "docker",
            ["login", "--username", username, "--password-stdin"],
            { stdio: ["pipe", process.stderr, process.stderr] },
        );

        login.on("error", reject);
        login.on("close", (code) => {
            if (code === 0) {
                resolve();
                return;
            }
            reject(new Error(`docker login exited with status ${code}`));
        });
        login.stdin.end(token);
    });
}

async function loginWithEnvironmentCredentials() {
    const client = await sdk.createClient({
        integrationName: "GitLab CI",
        integrationVersion: "v1.0.0",
        oidcFetcher: fetchOidcToken,
        workloadDetails: {
            workloadUuid: process.env.OP_WORKLOAD_ID,
            // SDK 0.5.0-beta.1 only accepts unpadded integration keys.
            customerManagedSecret: process.env.OP_INTEGRATION_KEY.replace(/=+$/, ""),
        },
    });

    const { variables } = await client.environments.getVariables(
        process.env.OP_ENVIRONMENT_ID,
    );
    const dockerHubUsername = variables.find(
        ({ name }) => name === "DOCKERHUB_USERNAME",
    ).value;
    const dockerHubToken = variables.find(
        ({ name }) => name === "DOCKERHUB_TOKEN",
    ).value;

    await loginToDockerCLI(dockerHubUsername, dockerHubToken);
    process.stdout.write(dockerHubUsername);
}

loginWithEnvironmentCredentials().catch((error) => {
    console.error(error);
    process.exitCode = 1;
});

.gitlab-ci.yml

build-and-push:
  image: docker:27-cli
  services:
    - docker:27-dind
  id_tokens:
    GITLAB_SUBJECT_TOKEN:
      aud: $OP_OIDC_AUDIENCE
  variables:
    DOCKER_TLS_CERTDIR: "/certs"
  before_script:
    - apk add --no-cache nodejs npm
    - npm ci
  script:
    # Authenticate Docker CLI with credentials stored in 1Password environment.
    - DOCKERHUB_USERNAME="$(node ./op-client-example.js)"

    # Build and push the Docker image to Docker Hub.
    - DOCKER_IMAGE="$DOCKERHUB_USERNAME/$DOCKERHUB_REPOSITORY:$CI_COMMIT_SHA"
    - docker build --tag "$DOCKER_IMAGE" .
    - docker push "$DOCKER_IMAGE"

Get help

If you don’t see Generic OIDC as a destination in the 1Password desktop app, make sure your administrator has connected an OIDC provider to your 1Password account.

​Step 1: Set up an Environment

​Step 2. Connect your Environment to your workflow

​Step 3: Use your Environment in your workflow

​Usage example

​Get help

​Learn more

Step 1: Set up an Environment

Step 2. Connect your Environment to your workflow

Step 3: Use your Environment in your workflow

Usage example

Get help

Learn more